2005-04-17 02:20:36 +04:00
|
|
|
/*
|
|
|
|
* linux/arch/arm/mm/fault.c
|
|
|
|
*
|
|
|
|
* Copyright (C) 1995 Linus Torvalds
|
|
|
|
* Modifications for ARM processor (c) 1995-2004 Russell King
|
|
|
|
*
|
|
|
|
* This program is free software; you can redistribute it and/or modify
|
|
|
|
* it under the terms of the GNU General Public License version 2 as
|
|
|
|
* published by the Free Software Foundation.
|
|
|
|
*/
|
2016-07-23 21:01:45 +03:00
|
|
|
#include <linux/extable.h>
|
2005-04-17 02:20:36 +04:00
|
|
|
#include <linux/signal.h>
|
|
|
|
#include <linux/mm.h>
|
2008-12-14 21:01:44 +03:00
|
|
|
#include <linux/hardirq.h>
|
2005-04-17 02:20:36 +04:00
|
|
|
#include <linux/init.h>
|
2007-12-03 23:21:57 +03:00
|
|
|
#include <linux/kprobes.h>
|
2008-09-06 14:35:55 +04:00
|
|
|
#include <linux/uaccess.h>
|
2008-09-11 19:52:02 +04:00
|
|
|
#include <linux/page-flags.h>
|
2017-02-08 20:51:30 +03:00
|
|
|
#include <linux/sched/signal.h>
|
2017-02-08 20:51:35 +03:00
|
|
|
#include <linux/sched/debug.h>
|
2009-08-17 23:02:06 +04:00
|
|
|
#include <linux/highmem.h>
|
2010-02-02 22:24:58 +03:00
|
|
|
#include <linux/perf_event.h>
|
2005-04-17 02:20:36 +04:00
|
|
|
|
|
|
|
#include <asm/pgtable.h>
|
2012-03-28 21:30:01 +04:00
|
|
|
#include <asm/system_misc.h>
|
|
|
|
#include <asm/system_info.h>
|
2005-04-17 02:20:36 +04:00
|
|
|
#include <asm/tlbflush.h>
|
|
|
|
|
|
|
|
#include "fault.h"
|
|
|
|
|
2009-07-24 15:34:55 +04:00
|
|
|
#ifdef CONFIG_MMU
|
2007-12-03 23:21:57 +03:00
|
|
|
|
|
|
|
#ifdef CONFIG_KPROBES
|
|
|
|
static inline int notify_page_fault(struct pt_regs *regs, unsigned int fsr)
|
|
|
|
{
|
|
|
|
int ret = 0;
|
|
|
|
|
|
|
|
if (!user_mode(regs)) {
|
|
|
|
/* kprobe_running() needs smp_processor_id() */
|
|
|
|
preempt_disable();
|
|
|
|
if (kprobe_running() && kprobe_fault_handler(regs, fsr))
|
|
|
|
ret = 1;
|
|
|
|
preempt_enable();
|
|
|
|
}
|
|
|
|
|
|
|
|
return ret;
|
|
|
|
}
|
|
|
|
#else
|
|
|
|
static inline int notify_page_fault(struct pt_regs *regs, unsigned int fsr)
|
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
|
2005-04-17 02:20:36 +04:00
|
|
|
/*
|
|
|
|
* This is useful to dump out the page tables associated with
|
|
|
|
* 'addr' in mm 'mm'.
|
|
|
|
*/
|
|
|
|
void show_pte(struct mm_struct *mm, unsigned long addr)
|
|
|
|
{
|
|
|
|
pgd_t *pgd;
|
|
|
|
|
|
|
|
if (!mm)
|
|
|
|
mm = &init_mm;
|
|
|
|
|
2014-10-28 14:26:42 +03:00
|
|
|
pr_alert("pgd = %p\n", mm->pgd);
|
2005-04-17 02:20:36 +04:00
|
|
|
pgd = pgd_offset(mm, addr);
|
2014-10-28 14:26:42 +03:00
|
|
|
pr_alert("[%08lx] *pgd=%08llx",
|
2011-02-15 16:31:37 +03:00
|
|
|
addr, (long long)pgd_val(*pgd));
|
2005-04-17 02:20:36 +04:00
|
|
|
|
|
|
|
do {
|
2010-11-21 19:27:49 +03:00
|
|
|
pud_t *pud;
|
2005-04-17 02:20:36 +04:00
|
|
|
pmd_t *pmd;
|
|
|
|
pte_t *pte;
|
|
|
|
|
|
|
|
if (pgd_none(*pgd))
|
|
|
|
break;
|
|
|
|
|
|
|
|
if (pgd_bad(*pgd)) {
|
2014-10-28 14:26:42 +03:00
|
|
|
pr_cont("(bad)");
|
2005-04-17 02:20:36 +04:00
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
2010-11-21 19:27:49 +03:00
|
|
|
pud = pud_offset(pgd, addr);
|
|
|
|
if (PTRS_PER_PUD != 1)
|
2014-10-28 14:26:42 +03:00
|
|
|
pr_cont(", *pud=%08llx", (long long)pud_val(*pud));
|
2010-11-21 19:27:49 +03:00
|
|
|
|
|
|
|
if (pud_none(*pud))
|
|
|
|
break;
|
|
|
|
|
|
|
|
if (pud_bad(*pud)) {
|
2014-10-28 14:26:42 +03:00
|
|
|
pr_cont("(bad)");
|
2010-11-21 19:27:49 +03:00
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
|
|
|
pmd = pmd_offset(pud, addr);
|
2008-09-30 19:10:11 +04:00
|
|
|
if (PTRS_PER_PMD != 1)
|
2014-10-28 14:26:42 +03:00
|
|
|
pr_cont(", *pmd=%08llx", (long long)pmd_val(*pmd));
|
2005-04-17 02:20:36 +04:00
|
|
|
|
|
|
|
if (pmd_none(*pmd))
|
|
|
|
break;
|
|
|
|
|
|
|
|
if (pmd_bad(*pmd)) {
|
2014-10-28 14:26:42 +03:00
|
|
|
pr_cont("(bad)");
|
2005-04-17 02:20:36 +04:00
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* We must not map this if we have highmem enabled */
|
2008-09-11 19:52:02 +04:00
|
|
|
if (PageHighMem(pfn_to_page(pmd_val(*pmd) >> PAGE_SHIFT)))
|
|
|
|
break;
|
|
|
|
|
2005-04-17 02:20:36 +04:00
|
|
|
pte = pte_offset_map(pmd, addr);
|
2014-10-28 14:26:42 +03:00
|
|
|
pr_cont(", *pte=%08llx", (long long)pte_val(*pte));
|
2011-11-22 21:30:31 +04:00
|
|
|
#ifndef CONFIG_ARM_LPAE
|
2014-10-28 14:26:42 +03:00
|
|
|
pr_cont(", *ppte=%08llx",
|
2011-02-15 16:31:37 +03:00
|
|
|
(long long)pte_val(pte[PTE_HWTABLE_PTRS]));
|
2011-11-22 21:30:31 +04:00
|
|
|
#endif
|
2005-04-17 02:20:36 +04:00
|
|
|
pte_unmap(pte);
|
|
|
|
} while(0);
|
|
|
|
|
2014-10-28 14:26:42 +03:00
|
|
|
pr_cont("\n");
|
2005-04-17 02:20:36 +04:00
|
|
|
}
|
2009-07-24 15:34:55 +04:00
|
|
|
#else /* CONFIG_MMU */
|
|
|
|
void show_pte(struct mm_struct *mm, unsigned long addr)
|
|
|
|
{ }
|
|
|
|
#endif /* CONFIG_MMU */
|
2005-04-17 02:20:36 +04:00
|
|
|
|
|
|
|
/*
|
|
|
|
* Oops. The kernel tried to access some page that wasn't present.
|
|
|
|
*/
|
|
|
|
static void
|
|
|
|
__do_kernel_fault(struct mm_struct *mm, unsigned long addr, unsigned int fsr,
|
|
|
|
struct pt_regs *regs)
|
|
|
|
{
|
|
|
|
/*
|
|
|
|
* Are we prepared to handle this kernel fault?
|
|
|
|
*/
|
|
|
|
if (fixup_exception(regs))
|
|
|
|
return;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* No handler, we'll have to terminate things with extreme prejudice.
|
|
|
|
*/
|
|
|
|
bust_spinlocks(1);
|
2014-10-28 14:26:42 +03:00
|
|
|
pr_alert("Unable to handle kernel %s at virtual address %08lx\n",
|
|
|
|
(addr < PAGE_SIZE) ? "NULL pointer dereference" :
|
|
|
|
"paging request", addr);
|
2005-04-17 02:20:36 +04:00
|
|
|
|
|
|
|
show_pte(mm, addr);
|
|
|
|
die("Oops", regs, fsr);
|
|
|
|
bust_spinlocks(0);
|
|
|
|
do_exit(SIGKILL);
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Something tried to access memory that isn't in our memory map..
|
|
|
|
* User mode accesses just cause a SIGSEGV
|
|
|
|
*/
|
|
|
|
static void
|
|
|
|
__do_user_fault(struct task_struct *tsk, unsigned long addr,
|
2005-04-17 02:23:55 +04:00
|
|
|
unsigned int fsr, unsigned int sig, int code,
|
|
|
|
struct pt_regs *regs)
|
2005-04-17 02:20:36 +04:00
|
|
|
{
|
2018-05-14 16:20:21 +03:00
|
|
|
if (addr > TASK_SIZE)
|
|
|
|
harden_branch_predictor();
|
|
|
|
|
2005-04-17 02:20:36 +04:00
|
|
|
#ifdef CONFIG_DEBUG_USER
|
2012-02-06 18:45:36 +04:00
|
|
|
if (((user_debug & UDBG_SEGV) && (sig == SIGSEGV)) ||
|
|
|
|
((user_debug & UDBG_BUS) && (sig == SIGBUS))) {
|
2005-04-17 02:23:55 +04:00
|
|
|
printk(KERN_DEBUG "%s: unhandled page fault (%d) at 0x%08lx, code 0x%03x\n",
|
|
|
|
tsk->comm, sig, addr, fsr);
|
2005-04-17 02:20:36 +04:00
|
|
|
show_pte(tsk->mm, addr);
|
|
|
|
show_regs(regs);
|
|
|
|
}
|
|
|
|
#endif
|
2018-11-01 01:53:12 +03:00
|
|
|
#ifndef CONFIG_KUSER_HELPERS
|
|
|
|
if ((sig == SIGSEGV) && ((addr & PAGE_MASK) == 0xffff0000))
|
|
|
|
printk_ratelimited(KERN_DEBUG
|
|
|
|
"%s: CONFIG_KUSER_HELPERS disabled at 0x%08lx\n",
|
|
|
|
tsk->comm, addr);
|
|
|
|
#endif
|
2005-04-17 02:20:36 +04:00
|
|
|
|
|
|
|
tsk->thread.address = addr;
|
|
|
|
tsk->thread.error_code = fsr;
|
|
|
|
tsk->thread.trap_no = 14;
|
2018-06-18 22:50:26 +03:00
|
|
|
force_sig_fault(sig, code, (void __user *)addr, tsk);
|
2005-04-17 02:20:36 +04:00
|
|
|
}
|
|
|
|
|
2006-09-27 19:13:48 +04:00
|
|
|
void do_bad_area(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
|
2005-04-17 02:20:36 +04:00
|
|
|
{
|
2006-09-27 19:13:48 +04:00
|
|
|
struct task_struct *tsk = current;
|
|
|
|
struct mm_struct *mm = tsk->active_mm;
|
|
|
|
|
2005-04-17 02:20:36 +04:00
|
|
|
/*
|
|
|
|
* If we are in kernel mode at this point, we
|
|
|
|
* have no context to handle this fault with.
|
|
|
|
*/
|
|
|
|
if (user_mode(regs))
|
2005-04-17 02:23:55 +04:00
|
|
|
__do_user_fault(tsk, addr, fsr, SIGSEGV, SEGV_MAPERR, regs);
|
2005-04-17 02:20:36 +04:00
|
|
|
else
|
|
|
|
__do_kernel_fault(mm, addr, fsr, regs);
|
|
|
|
}
|
|
|
|
|
2009-07-24 15:34:55 +04:00
|
|
|
#ifdef CONFIG_MMU
|
2007-07-20 11:21:06 +04:00
|
|
|
#define VM_FAULT_BADMAP 0x010000
|
|
|
|
#define VM_FAULT_BADACCESS 0x020000
|
2005-04-17 02:20:36 +04:00
|
|
|
|
2009-09-20 15:53:01 +04:00
|
|
|
/*
|
|
|
|
* Check that the permissions on the VMA allow for the fault which occurred.
|
|
|
|
* If we encountered a write fault, we must have write permission, otherwise
|
|
|
|
* we allow any permission.
|
|
|
|
*/
|
|
|
|
static inline bool access_error(unsigned int fsr, struct vm_area_struct *vma)
|
|
|
|
{
|
|
|
|
unsigned int mask = VM_READ | VM_WRITE | VM_EXEC;
|
|
|
|
|
|
|
|
if (fsr & FSR_WRITE)
|
|
|
|
mask = VM_WRITE;
|
2009-09-20 16:18:47 +04:00
|
|
|
if (fsr & FSR_LNX_PF)
|
|
|
|
mask = VM_EXEC;
|
2009-09-20 15:53:01 +04:00
|
|
|
|
|
|
|
return vma->vm_flags & mask ? false : true;
|
|
|
|
}
|
|
|
|
|
2018-08-18 01:44:47 +03:00
|
|
|
static vm_fault_t __kprobes
|
2005-04-17 02:20:36 +04:00
|
|
|
__do_page_fault(struct mm_struct *mm, unsigned long addr, unsigned int fsr,
|
2011-11-27 20:49:50 +04:00
|
|
|
unsigned int flags, struct task_struct *tsk)
|
2005-04-17 02:20:36 +04:00
|
|
|
{
|
|
|
|
struct vm_area_struct *vma;
|
2018-08-18 01:44:47 +03:00
|
|
|
vm_fault_t fault;
|
2005-04-17 02:20:36 +04:00
|
|
|
|
|
|
|
vma = find_vma(mm, addr);
|
|
|
|
fault = VM_FAULT_BADMAP;
|
2009-09-20 15:53:01 +04:00
|
|
|
if (unlikely(!vma))
|
2005-04-17 02:20:36 +04:00
|
|
|
goto out;
|
2009-09-20 15:53:01 +04:00
|
|
|
if (unlikely(vma->vm_start > addr))
|
2005-04-17 02:20:36 +04:00
|
|
|
goto check_stack;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Ok, we have a good vm_area for this
|
|
|
|
* memory access, so we can handle it.
|
|
|
|
*/
|
|
|
|
good_area:
|
2009-09-20 15:53:01 +04:00
|
|
|
if (access_error(fsr, vma)) {
|
|
|
|
fault = VM_FAULT_BADACCESS;
|
2005-04-17 02:20:36 +04:00
|
|
|
goto out;
|
2009-09-20 15:53:01 +04:00
|
|
|
}
|
2005-04-17 02:20:36 +04:00
|
|
|
|
2016-07-27 01:25:18 +03:00
|
|
|
return handle_mm_fault(vma, addr & PAGE_MASK, flags);
|
2005-04-17 02:20:36 +04:00
|
|
|
|
|
|
|
check_stack:
|
2012-05-16 18:19:20 +04:00
|
|
|
/* Don't allow expansion below FIRST_USER_ADDRESS */
|
|
|
|
if (vma->vm_flags & VM_GROWSDOWN &&
|
|
|
|
addr >= FIRST_USER_ADDRESS && !expand_stack(vma, addr))
|
2005-04-17 02:20:36 +04:00
|
|
|
goto good_area;
|
|
|
|
out:
|
|
|
|
return fault;
|
|
|
|
}
|
|
|
|
|
2007-12-03 23:27:56 +03:00
|
|
|
static int __kprobes
|
2005-04-17 02:20:36 +04:00
|
|
|
do_page_fault(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
|
|
|
|
{
|
|
|
|
struct task_struct *tsk;
|
|
|
|
struct mm_struct *mm;
|
2018-08-18 01:44:47 +03:00
|
|
|
int sig, code;
|
|
|
|
vm_fault_t fault;
|
2013-09-13 02:13:39 +04:00
|
|
|
unsigned int flags = FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_KILLABLE;
|
2005-04-17 02:20:36 +04:00
|
|
|
|
2007-12-03 23:21:57 +03:00
|
|
|
if (notify_page_fault(regs, fsr))
|
|
|
|
return 0;
|
|
|
|
|
2005-04-17 02:20:36 +04:00
|
|
|
tsk = current;
|
|
|
|
mm = tsk->mm;
|
|
|
|
|
2011-06-25 14:44:06 +04:00
|
|
|
/* Enable interrupts if they were enabled in the parent context. */
|
|
|
|
if (interrupts_enabled(regs))
|
|
|
|
local_irq_enable();
|
|
|
|
|
2005-04-17 02:20:36 +04:00
|
|
|
/*
|
|
|
|
* If we're in an interrupt or have no user
|
|
|
|
* context, we must not take the fault..
|
|
|
|
*/
|
2015-05-11 18:52:11 +03:00
|
|
|
if (faulthandler_disabled() || !mm)
|
2005-04-17 02:20:36 +04:00
|
|
|
goto no_context;
|
|
|
|
|
2013-09-13 02:13:39 +04:00
|
|
|
if (user_mode(regs))
|
|
|
|
flags |= FAULT_FLAG_USER;
|
|
|
|
if (fsr & FSR_WRITE)
|
|
|
|
flags |= FAULT_FLAG_WRITE;
|
|
|
|
|
2005-09-20 20:52:13 +04:00
|
|
|
/*
|
|
|
|
* As per x86, we may deadlock here. However, since the kernel only
|
|
|
|
* validly references user space from well defined areas of the code,
|
|
|
|
* we can bug out early if this is from code which shouldn't.
|
|
|
|
*/
|
|
|
|
if (!down_read_trylock(&mm->mmap_sem)) {
|
|
|
|
if (!user_mode(regs) && !search_exception_tables(regs->ARM_pc))
|
|
|
|
goto no_context;
|
2011-11-27 20:49:50 +04:00
|
|
|
retry:
|
2005-09-20 20:52:13 +04:00
|
|
|
down_read(&mm->mmap_sem);
|
2009-09-20 15:52:19 +04:00
|
|
|
} else {
|
|
|
|
/*
|
|
|
|
* The above down_read_trylock() might have succeeded in
|
|
|
|
* which case, we'll have missed the might_sleep() from
|
|
|
|
* down_read()
|
|
|
|
*/
|
|
|
|
might_sleep();
|
2009-10-05 16:40:44 +04:00
|
|
|
#ifdef CONFIG_DEBUG_VM
|
|
|
|
if (!user_mode(regs) &&
|
|
|
|
!search_exception_tables(regs->ARM_pc))
|
|
|
|
goto no_context;
|
|
|
|
#endif
|
2005-09-20 20:52:13 +04:00
|
|
|
}
|
|
|
|
|
2011-11-27 20:49:50 +04:00
|
|
|
fault = __do_page_fault(mm, addr, fsr, flags, tsk);
|
|
|
|
|
|
|
|
/* If we need to retry but a fatal signal is pending, handle the
|
|
|
|
* signal first. We do not need to release the mmap_sem because
|
|
|
|
* it would already be released in __lock_page_or_retry in
|
|
|
|
* mm/filemap.c. */
|
ARM: 8692/1: mm: abort uaccess retries upon fatal signal
When there's a fatal signal pending, arm's do_page_fault()
implementation returns 0. The intent is that we'll return to the
faulting userspace instruction, delivering the signal on the way.
However, if we take a fatal signal during fixing up a uaccess, this
results in a return to the faulting kernel instruction, which will be
instantly retried, resulting in the same fault being taken forever. As
the task never reaches userspace, the signal is not delivered, and the
task is left unkillable. While the task is stuck in this state, it can
inhibit the forward progress of the system.
To avoid this, we must ensure that when a fatal signal is pending, we
apply any necessary fixup for a faulting kernel instruction. Thus we
will return to an error path, and it is up to that code to make forward
progress towards delivering the fatal signal.
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Reviewed-by: Steve Capper <steve.capper@arm.com>
Cc: stable@vger.kernel.org
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
2017-08-22 13:36:17 +03:00
|
|
|
if ((fault & VM_FAULT_RETRY) && fatal_signal_pending(current)) {
|
|
|
|
if (!user_mode(regs))
|
|
|
|
goto no_context;
|
2011-11-27 20:49:50 +04:00
|
|
|
return 0;
|
ARM: 8692/1: mm: abort uaccess retries upon fatal signal
When there's a fatal signal pending, arm's do_page_fault()
implementation returns 0. The intent is that we'll return to the
faulting userspace instruction, delivering the signal on the way.
However, if we take a fatal signal during fixing up a uaccess, this
results in a return to the faulting kernel instruction, which will be
instantly retried, resulting in the same fault being taken forever. As
the task never reaches userspace, the signal is not delivered, and the
task is left unkillable. While the task is stuck in this state, it can
inhibit the forward progress of the system.
To avoid this, we must ensure that when a fatal signal is pending, we
apply any necessary fixup for a faulting kernel instruction. Thus we
will return to an error path, and it is up to that code to make forward
progress towards delivering the fatal signal.
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Reviewed-by: Steve Capper <steve.capper@arm.com>
Cc: stable@vger.kernel.org
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
2017-08-22 13:36:17 +03:00
|
|
|
}
|
2011-11-27 20:49:50 +04:00
|
|
|
|
|
|
|
/*
|
|
|
|
* Major/minor page fault accounting is only done on the
|
|
|
|
* initial attempt. If we go through a retry, it is extremely
|
|
|
|
* likely that the page will be found in page cache at that point.
|
|
|
|
*/
|
2005-04-17 02:20:36 +04:00
|
|
|
|
2011-06-27 16:41:57 +04:00
|
|
|
perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS, 1, regs, addr);
|
2012-04-02 21:19:49 +04:00
|
|
|
if (!(fault & VM_FAULT_ERROR) && flags & FAULT_FLAG_ALLOW_RETRY) {
|
2011-11-27 20:49:50 +04:00
|
|
|
if (fault & VM_FAULT_MAJOR) {
|
|
|
|
tsk->maj_flt++;
|
|
|
|
perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MAJ, 1,
|
|
|
|
regs, addr);
|
|
|
|
} else {
|
|
|
|
tsk->min_flt++;
|
|
|
|
perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MIN, 1,
|
|
|
|
regs, addr);
|
|
|
|
}
|
|
|
|
if (fault & VM_FAULT_RETRY) {
|
|
|
|
/* Clear FAULT_FLAG_ALLOW_RETRY to avoid any risk
|
|
|
|
* of starvation. */
|
|
|
|
flags &= ~FAULT_FLAG_ALLOW_RETRY;
|
2012-10-09 03:32:19 +04:00
|
|
|
flags |= FAULT_FLAG_TRIED;
|
2011-11-27 20:49:50 +04:00
|
|
|
goto retry;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
up_read(&mm->mmap_sem);
|
2010-02-02 22:24:58 +03:00
|
|
|
|
2005-04-17 02:20:36 +04:00
|
|
|
/*
|
2016-03-18 00:19:55 +03:00
|
|
|
* Handle the "normal" case first - VM_FAULT_MAJOR
|
2005-04-17 02:20:36 +04:00
|
|
|
*/
|
2007-07-20 11:21:06 +04:00
|
|
|
if (likely(!(fault & (VM_FAULT_ERROR | VM_FAULT_BADMAP | VM_FAULT_BADACCESS))))
|
2005-04-17 02:20:36 +04:00
|
|
|
return 0;
|
|
|
|
|
2013-09-13 02:13:38 +04:00
|
|
|
/*
|
|
|
|
* If we are in kernel mode at this point, we
|
|
|
|
* have no context to handle this fault with.
|
|
|
|
*/
|
|
|
|
if (!user_mode(regs))
|
|
|
|
goto no_context;
|
|
|
|
|
2009-09-20 15:47:40 +04:00
|
|
|
if (fault & VM_FAULT_OOM) {
|
|
|
|
/*
|
|
|
|
* We ran out of memory, call the OOM killer, and return to
|
|
|
|
* userspace (which will retry the fault, or kill us if we
|
|
|
|
* got oom-killed)
|
|
|
|
*/
|
|
|
|
pagefault_out_of_memory();
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2007-07-19 12:47:05 +04:00
|
|
|
if (fault & VM_FAULT_SIGBUS) {
|
2005-04-17 02:23:55 +04:00
|
|
|
/*
|
|
|
|
* We had some memory, but were unable to
|
|
|
|
* successfully fix up this page fault.
|
|
|
|
*/
|
|
|
|
sig = SIGBUS;
|
|
|
|
code = BUS_ADRERR;
|
2007-07-19 12:47:05 +04:00
|
|
|
} else {
|
2005-04-17 02:23:55 +04:00
|
|
|
/*
|
|
|
|
* Something tried to access memory that
|
|
|
|
* isn't in our memory map..
|
|
|
|
*/
|
|
|
|
sig = SIGSEGV;
|
|
|
|
code = fault == VM_FAULT_BADACCESS ?
|
|
|
|
SEGV_ACCERR : SEGV_MAPERR;
|
2005-04-17 02:20:36 +04:00
|
|
|
}
|
|
|
|
|
2005-04-17 02:23:55 +04:00
|
|
|
__do_user_fault(tsk, addr, fsr, sig, code, regs);
|
|
|
|
return 0;
|
2005-04-17 02:20:36 +04:00
|
|
|
|
|
|
|
no_context:
|
|
|
|
__do_kernel_fault(mm, addr, fsr, regs);
|
|
|
|
return 0;
|
|
|
|
}
|
2009-07-24 15:34:55 +04:00
|
|
|
#else /* CONFIG_MMU */
|
|
|
|
static int
|
|
|
|
do_page_fault(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
|
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
#endif /* CONFIG_MMU */
|
2005-04-17 02:20:36 +04:00
|
|
|
|
|
|
|
/*
|
|
|
|
* First Level Translation Fault Handler
|
|
|
|
*
|
|
|
|
* We enter here because the first level page table doesn't contain
|
|
|
|
* a valid entry for the address.
|
|
|
|
*
|
|
|
|
* If the address is in kernel space (>= TASK_SIZE), then we are
|
|
|
|
* probably faulting in the vmalloc() area.
|
|
|
|
*
|
|
|
|
* If the init_task's first level page tables contains the relevant
|
|
|
|
* entry, we copy the it to this task. If not, we send the process
|
|
|
|
* a signal, fixup the exception, or oops the kernel.
|
|
|
|
*
|
|
|
|
* NOTE! We MUST NOT take any locks for this case. We may be in an
|
|
|
|
* interrupt or a critical region, and should only copy the information
|
|
|
|
* from the master page table, nothing more.
|
|
|
|
*/
|
2009-07-24 15:34:55 +04:00
|
|
|
#ifdef CONFIG_MMU
|
2007-12-03 23:27:56 +03:00
|
|
|
static int __kprobes
|
2005-04-17 02:20:36 +04:00
|
|
|
do_translation_fault(unsigned long addr, unsigned int fsr,
|
|
|
|
struct pt_regs *regs)
|
|
|
|
{
|
|
|
|
unsigned int index;
|
|
|
|
pgd_t *pgd, *pgd_k;
|
2010-11-21 19:27:49 +03:00
|
|
|
pud_t *pud, *pud_k;
|
2005-04-17 02:20:36 +04:00
|
|
|
pmd_t *pmd, *pmd_k;
|
|
|
|
|
|
|
|
if (addr < TASK_SIZE)
|
|
|
|
return do_page_fault(addr, fsr, regs);
|
|
|
|
|
2010-06-08 18:16:49 +04:00
|
|
|
if (user_mode(regs))
|
|
|
|
goto bad_area;
|
|
|
|
|
2005-04-17 02:20:36 +04:00
|
|
|
index = pgd_index(addr);
|
|
|
|
|
|
|
|
pgd = cpu_get_pgd() + index;
|
|
|
|
pgd_k = init_mm.pgd + index;
|
|
|
|
|
|
|
|
if (pgd_none(*pgd_k))
|
|
|
|
goto bad_area;
|
|
|
|
if (!pgd_present(*pgd))
|
|
|
|
set_pgd(pgd, *pgd_k);
|
|
|
|
|
2010-11-21 19:27:49 +03:00
|
|
|
pud = pud_offset(pgd, addr);
|
|
|
|
pud_k = pud_offset(pgd_k, addr);
|
|
|
|
|
|
|
|
if (pud_none(*pud_k))
|
|
|
|
goto bad_area;
|
|
|
|
if (!pud_present(*pud))
|
|
|
|
set_pud(pud, *pud_k);
|
|
|
|
|
|
|
|
pmd = pmd_offset(pud, addr);
|
|
|
|
pmd_k = pmd_offset(pud_k, addr);
|
2005-04-17 02:20:36 +04:00
|
|
|
|
2011-11-22 21:30:31 +04:00
|
|
|
#ifdef CONFIG_ARM_LPAE
|
|
|
|
/*
|
|
|
|
* Only one hardware entry per PMD with LPAE.
|
|
|
|
*/
|
|
|
|
index = 0;
|
|
|
|
#else
|
2010-07-22 16:20:22 +04:00
|
|
|
/*
|
|
|
|
* On ARM one Linux PGD entry contains two hardware entries (see page
|
|
|
|
* tables layout in pgtable.h). We normally guarantee that we always
|
|
|
|
* fill both L1 entries. But create_mapping() doesn't follow the rule.
|
|
|
|
* It can create inidividual L1 entries, so here we have to call
|
|
|
|
* pmd_none() check for the entry really corresponded to address, not
|
|
|
|
* for the first of pair.
|
|
|
|
*/
|
|
|
|
index = (addr >> SECTION_SHIFT) & 1;
|
2011-11-22 21:30:31 +04:00
|
|
|
#endif
|
2010-07-22 16:20:22 +04:00
|
|
|
if (pmd_none(pmd_k[index]))
|
2005-04-17 02:20:36 +04:00
|
|
|
goto bad_area;
|
|
|
|
|
|
|
|
copy_pmd(pmd, pmd_k);
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
bad_area:
|
2006-09-27 19:13:48 +04:00
|
|
|
do_bad_area(addr, fsr, regs);
|
2005-04-17 02:20:36 +04:00
|
|
|
return 0;
|
|
|
|
}
|
2009-07-24 15:34:55 +04:00
|
|
|
#else /* CONFIG_MMU */
|
|
|
|
static int
|
|
|
|
do_translation_fault(unsigned long addr, unsigned int fsr,
|
|
|
|
struct pt_regs *regs)
|
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
#endif /* CONFIG_MMU */
|
2005-04-17 02:20:36 +04:00
|
|
|
|
|
|
|
/*
|
|
|
|
* Some section permission faults need to be handled gracefully.
|
|
|
|
* They can happen due to a __{get,put}_user during an oops.
|
|
|
|
*/
|
2013-06-25 11:45:51 +04:00
|
|
|
#ifndef CONFIG_ARM_LPAE
|
2005-04-17 02:20:36 +04:00
|
|
|
static int
|
|
|
|
do_sect_fault(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
|
|
|
|
{
|
2006-09-27 19:13:48 +04:00
|
|
|
do_bad_area(addr, fsr, regs);
|
2005-04-17 02:20:36 +04:00
|
|
|
return 0;
|
|
|
|
}
|
2013-06-25 11:45:51 +04:00
|
|
|
#endif /* CONFIG_ARM_LPAE */
|
2005-04-17 02:20:36 +04:00
|
|
|
|
|
|
|
/*
|
|
|
|
* This abort handler always returns "fault".
|
|
|
|
*/
|
|
|
|
static int
|
|
|
|
do_bad(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
|
|
|
|
{
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
2011-11-22 21:30:28 +04:00
|
|
|
struct fsr_info {
|
2005-04-17 02:20:36 +04:00
|
|
|
int (*fn)(unsigned long addr, unsigned int fsr, struct pt_regs *regs);
|
|
|
|
int sig;
|
2005-06-30 14:06:49 +04:00
|
|
|
int code;
|
2005-04-17 02:20:36 +04:00
|
|
|
const char *name;
|
|
|
|
};
|
|
|
|
|
2011-11-22 21:30:28 +04:00
|
|
|
/* FSR definition */
|
2011-11-22 21:30:31 +04:00
|
|
|
#ifdef CONFIG_ARM_LPAE
|
|
|
|
#include "fsr-3level.c"
|
|
|
|
#else
|
2011-11-22 21:30:28 +04:00
|
|
|
#include "fsr-2level.c"
|
2011-11-22 21:30:31 +04:00
|
|
|
#endif
|
2011-11-22 21:30:28 +04:00
|
|
|
|
2005-04-17 02:20:36 +04:00
|
|
|
void __init
|
|
|
|
hook_fault_code(int nr, int (*fn)(unsigned long, unsigned int, struct pt_regs *),
|
2010-07-22 16:18:19 +04:00
|
|
|
int sig, int code, const char *name)
|
2005-04-17 02:20:36 +04:00
|
|
|
{
|
2010-07-22 16:18:19 +04:00
|
|
|
if (nr < 0 || nr >= ARRAY_SIZE(fsr_info))
|
|
|
|
BUG();
|
|
|
|
|
|
|
|
fsr_info[nr].fn = fn;
|
|
|
|
fsr_info[nr].sig = sig;
|
|
|
|
fsr_info[nr].code = code;
|
|
|
|
fsr_info[nr].name = name;
|
2005-04-17 02:20:36 +04:00
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Dispatch a data abort to the relevant handler.
|
|
|
|
*/
|
2017-11-25 02:54:22 +03:00
|
|
|
asmlinkage void
|
2005-04-17 02:20:36 +04:00
|
|
|
do_DataAbort(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
|
|
|
|
{
|
2009-09-20 15:41:58 +04:00
|
|
|
const struct fsr_info *inf = fsr_info + fsr_fs(fsr);
|
2005-04-17 02:20:36 +04:00
|
|
|
|
2009-09-20 16:18:47 +04:00
|
|
|
if (!inf->fn(addr, fsr & ~FSR_LNX_PF, regs))
|
2005-04-17 02:20:36 +04:00
|
|
|
return;
|
|
|
|
|
2014-10-28 14:26:42 +03:00
|
|
|
pr_alert("Unhandled fault: %s (0x%03x) at 0x%08lx\n",
|
2005-04-17 02:20:36 +04:00
|
|
|
inf->name, fsr, addr);
|
2015-03-10 22:40:55 +03:00
|
|
|
show_pte(current->mm, addr);
|
2005-06-30 14:06:49 +04:00
|
|
|
|
2018-04-16 21:25:24 +03:00
|
|
|
arm_notify_die("", regs, inf->sig, inf->code, (void __user *)addr,
|
|
|
|
fsr, 0);
|
2005-04-17 02:20:36 +04:00
|
|
|
}
|
|
|
|
|
2010-09-03 13:39:59 +04:00
|
|
|
void __init
|
|
|
|
hook_ifault_code(int nr, int (*fn)(unsigned long, unsigned int, struct pt_regs *),
|
|
|
|
int sig, int code, const char *name)
|
|
|
|
{
|
|
|
|
if (nr < 0 || nr >= ARRAY_SIZE(ifsr_info))
|
|
|
|
BUG();
|
|
|
|
|
|
|
|
ifsr_info[nr].fn = fn;
|
|
|
|
ifsr_info[nr].sig = sig;
|
|
|
|
ifsr_info[nr].code = code;
|
|
|
|
ifsr_info[nr].name = name;
|
|
|
|
}
|
|
|
|
|
2017-11-25 02:54:22 +03:00
|
|
|
asmlinkage void
|
2009-09-25 16:39:47 +04:00
|
|
|
do_PrefetchAbort(unsigned long addr, unsigned int ifsr, struct pt_regs *regs)
|
2005-04-17 02:20:36 +04:00
|
|
|
{
|
2009-09-25 16:40:49 +04:00
|
|
|
const struct fsr_info *inf = ifsr_info + fsr_fs(ifsr);
|
|
|
|
|
|
|
|
if (!inf->fn(addr, ifsr | FSR_LNX_PF, regs))
|
|
|
|
return;
|
|
|
|
|
2014-10-28 14:26:42 +03:00
|
|
|
pr_alert("Unhandled prefetch abort: %s (0x%03x) at 0x%08lx\n",
|
2009-09-25 16:40:49 +04:00
|
|
|
inf->name, ifsr, addr);
|
|
|
|
|
2018-04-16 21:25:24 +03:00
|
|
|
arm_notify_die("", regs, inf->sig, inf->code, (void __user *)addr,
|
|
|
|
ifsr, 0);
|
2005-04-17 02:20:36 +04:00
|
|
|
}
|
|
|
|
|
2015-10-19 15:38:09 +03:00
|
|
|
/*
|
|
|
|
* Abort handler to be used only during first unmasking of asynchronous aborts
|
|
|
|
* on the boot CPU. This makes sure that the machine will not die if the
|
|
|
|
* firmware/bootloader left an imprecise abort pending for us to trip over.
|
|
|
|
*/
|
|
|
|
static int __init early_abort_handler(unsigned long addr, unsigned int fsr,
|
|
|
|
struct pt_regs *regs)
|
|
|
|
{
|
|
|
|
pr_warn("Hit pending asynchronous external abort (FSR=0x%08x) during "
|
|
|
|
"first unmask, this is most likely caused by a "
|
|
|
|
"firmware/bootloader bug.\n", fsr);
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
void __init early_abt_enable(void)
|
|
|
|
{
|
2017-01-17 23:10:11 +03:00
|
|
|
fsr_info[FSR_FS_AEA].fn = early_abort_handler;
|
2015-10-19 15:38:09 +03:00
|
|
|
local_abt_enable();
|
2017-01-17 23:10:11 +03:00
|
|
|
fsr_info[FSR_FS_AEA].fn = do_bad;
|
2015-10-19 15:38:09 +03:00
|
|
|
}
|
|
|
|
|
2011-11-22 21:30:31 +04:00
|
|
|
#ifndef CONFIG_ARM_LPAE
|
2010-07-22 16:23:25 +04:00
|
|
|
static int __init exceptions_init(void)
|
|
|
|
{
|
|
|
|
if (cpu_architecture() >= CPU_ARCH_ARMv6) {
|
|
|
|
hook_fault_code(4, do_translation_fault, SIGSEGV, SEGV_MAPERR,
|
|
|
|
"I-cache maintenance fault");
|
|
|
|
}
|
|
|
|
|
2010-07-26 14:20:41 +04:00
|
|
|
if (cpu_architecture() >= CPU_ARCH_ARMv7) {
|
|
|
|
/*
|
|
|
|
* TODO: Access flag faults introduced in ARMv6K.
|
|
|
|
* Runtime check for 'K' extension is needed
|
|
|
|
*/
|
|
|
|
hook_fault_code(3, do_bad, SIGSEGV, SEGV_MAPERR,
|
|
|
|
"section access flag fault");
|
|
|
|
hook_fault_code(6, do_bad, SIGSEGV, SEGV_MAPERR,
|
|
|
|
"section access flag fault");
|
|
|
|
}
|
|
|
|
|
2010-07-22 16:23:25 +04:00
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
arch_initcall(exceptions_init);
|
2011-11-22 21:30:31 +04:00
|
|
|
#endif
|